Ethod and computer storage node of shared storage system for abnormal behavior detection/analysis

ABSTRACT

A method utilized in a computer storage node includes: providing user interface device to be operated by an operator; sensing operation parameter of computer storage node to generate a first detection signal; controlling a display panel of user interface device to display data pattern of first detection signal on display panel according to a time scale; using first portion of first detection signal corresponding to a partial pattern of the data pattern to generate reference signal when the operator uses user interface device to mark a region on display panel to select the partial pattern; and comparing characteristics of the reference signal with characteristics of a processed detection signal to perform a behavior prediction operation.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation application of U.S. application Ser.No. 16/408,477, filed on May 10, 2019. The entire contents of therelated applications are incorporated herein by reference.

BACKGROUND OF THE INVENTION 1. Field of the Invention

The invention relates to a distributed shared storage system, and moreparticular to a computer storage node in the system and a methodutilized in the computer storage node.

2. Description of the Prior Art

Generally speaking, the design of operation and maintenance of a sharedstorage system are big challenges for an IT (information technology)operator user, which may include how to predict whether the performanceand capacity of the storage system satisfy the future requirementsand/or how to timely generate an alarm report to the operator when anabnormal access behavior is detected so as to make the operator be ableto timely response to such abnormal behavior.

SUMMARY OF THE INVENTION

Therefore one of the objectives of the invention is to provide a methodutilized in one of computer storage nodes in a distributed sharedstorage system and a computer storage node, to solve the conventionalproblems.

According to embodiments of the invention, a method utilized in one ofcomputer storage nodes in a distributed shared storage system isdisclosed. The method comprises: providing a user interface device to beoperated by an operator; sensing at least one operation parameter of thecomputer storage node to generate a first detection signal; andproviding and utilizing a processor to perform: controlling a displaypanel of the user interface device to display a data pattern of thefirst detection signal on the display panel according to a time scaleselected/adjusted by the operator; using the display panel displayingthe data pattern of the first detection signal for the operator based onthe adjusted time scale to make the operator select the data pattern'spartial pattern which is located within a region displayed by thedisplay panel, the data pattern's other portions are not located withinthe region; in response to the partial pattern selected by the operator,using a first portion of the first detection signal corresponding toonly the partial pattern of the data pattern as a reference signal, thereference signal is generated as a normal reference signal in responseto an event that the operator selects the partial pattern as a normalpattern and the reference signal is generated as an abnormal referencesignal in response to an event that the operator selects the partialpattern as an abnormal pattern; and comparing characteristics of thereference signal with characteristics of a processed detection signal toperform a behavior prediction operation.

According to the embodiments, a computer storage node in a plurality ofcomputer storage nodes in a distributed shared storage system isdisclosed. The computer storage node comprises a user interface, asensor module, and a processor. The user interface device comprises adisplay panel configured for display information for a user and at leastone computer input device operated by an operator. The sensor module isconfigure to sense at least one operation parameter of the computerstorage node to generate a first detection signal. The processor iscoupled to the user interface device and the sensor module, and isconfigured to: control a display panel of the user interface device todisplay a data pattern of the first detection signal on the displaypanel according to a time scale selected/adjusted by the operator; usethe display panel displaying the data pattern of the first detectionsignal for the operator based on the adjusted time scale to make theoperator select the data pattern's partial pattern which is locatedwithin a region displayed by the display panel, the data pattern's otherportions are not located within the region; in response to the partialpattern selected by the operator, using a first portion of the firstdetection signal corresponding to only the partial pattern of the datapattern as a reference signal, the reference signal is generated as anormal reference signal in response to an event that the operatorselects the partial pattern as a normal pattern and the reference signalis generated as an abnormal reference signal in response to an eventthat the operator selects the partial pattern as an abnormal pattern;and compare characteristics of the reference signal with characteristicsof a processed detection signal to perform a behavior predictionoperation.

These and other objectives of the present invention will no doubt becomeobvious to those of ordinary skill in the art after reading thefollowing detailed description of the preferred embodiment that isillustrated in the various figures and drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a decentralized storage system according toan embodiment of the invention.

FIG. 2 is a block diagram of a computer storage node according to anembodiment of the invention.

FIG. 3 is a diagram illustrating an example of a raw data patterndisplayed on the display panel of the UI device based on a time scalesuch as hours according to one embodiment of the invention.

FIG. 4 is a diagram illustrating an example of a raw data patterndisplayed on the display panel of the UI device based on a time scalesuch as hours according to another embodiment of the invention.

FIG. 5 is a diagram illustrating an example of a raw data patterndisplayed on the display panel of the UI device based on a time scalesuch as hours according to another embodiment of the invention.

FIG. 6 is a block diagram showing multiple software blocks of programsexecuted by the processor to real-time perform behavior analysis andprediction for further behavior.

DETAILED DESCRIPTION

The invention provides a solution to solve the conventional problems.Based on the provided solution, an operator can effectively and easilydefine a portion of a detection signal as normal patterns and/orabnormal patterns via a user interface (UI) device, and the storagesystem can store the defined normal patterns and/or abnormal patterns asspecific reference pattern(s) and then compare characteristics of thereference pattern(s) with characteristics of an incoming detectionsignal to perform behavior analysis operation so as to decide whether anabnormal operation behavior occurs.

FIG. 1 is a block diagram of a decentralized storage system 100according to an embodiment of the invention. The system 100 isimplemented by using a distributed network and comprises multiplecomputer storage nodes 105, and each computer storage node 105 isconnected to other computer storage nodes 105 via an internal sharednetwork. The computer storage nodes 105 are clustered together, a clientuser can connect to one computer storage node via an external network.If one computer storage node fails, the request of the client user isredirected to another working computer storage node. In addition, thesystem 100 can support a variety of specific communication protocolssuch as iSCSI, NFS, Samba, and so on. In addition, the system 100 cansupport the function of virtual storage. The modifications are notintended to be limitation.

FIG. 2 is a block diagram of a computer storage node 105 according to anembodiment of the invention. The computer storage node 105 comprises anUI device 110, a multi-core processor 115 comprising one or more centralprocessing units (CPU), a sensor module 120, a network interfacecontroller (NIC) 125 such as a network interface card, a static randomaccess memory (SRAM) 130 used as the processor cache, a host interfacecontroller (SATA) 135, a dynamic random access memory (DRAM) buffer 140,a flash controller 145, one or more hard-disk drives (HDD) 150 such astwo HDDs, and one or more solid-state drives (SSD) 155 such as four SSDsimplemented using NAND flash memory chips. The number of HDDs and thenumber of SSDs are not intended to be limitations.

The UI device 110 may comprise a display panel 1101 for displayingcontent/information for an operator and at least one computer inputdevices 1102 such as a computer keyboard and a computer mouse; theprocessor 115 is coupled to the display panel 1101 and computer inputdevices 1102 via the control bus and can send/receive information/signalto/from the display panel 1101 and computer input devices 1102. The UIdevice 110 is used to display information for the operator/user andreceive the input control command of the operator wherein the computerinput devices 1102 can be operated by the operator/user.

The processor 115 is coupled to the host interface controller 135, theSRAM 130, the DRAM buffer 140, the sensor module 120, the network IC125, the UI device 110, and the flash controller 145 via a control bus,and is arranged to send commands to control the above-mentioned devicesand perform complex calculations wherein data needed for the complexcalculations may be cached in the SRAM 130.

The network IC 125 is used to provide an external network IP so that aclient user may connect to the computer storage node 105 via the networkIC 125 to access data stored in the HDD 150 or in the SSD 155.

The host interface controller 135 is coupled to the HDDs 150 via anotherbus, and is used to receive the command sent from the processor 115 toaccess data stored in the HDDs 150. For example, if a client userrequest data or another computer storage node request a data clip, theprocessor 115 send a corresponding control command to the host interfacecontroller 135 and then the host interface controller 135 reads the dataor the data clip from the HDD 150 via the another bus so as to write thedata or data clip to the DRAM buffer 140 via the data bus. Thus, theclient user or the another computer storage node can retrieve the dataor data clip from the DRAM buffer 140.

The flash controller 145 is coupled to the SSDs 155 via another bus, andis used to receive the command sent from the processor 115 to accessdata stored in the SSDs 155. For example, if a client user request dataor another computer storage node request a data clip, the processor 115send a corresponding control command to the flash controller 145 andthen the flash controller 145 reads the data or the data clip from theSSD 155 via the flash bus so as to write the data or data clip to theDRAM buffer 140 via the data bus. Thus, the client user or the anothercomputer storage node can retrieve the data or data clip from the DRAMbuffer 140.

It should be noted that the embodiment of FIG. 2 is not intended to be alimitation. In other embodiments one computer storage node 105 maycomprise only one kind of storage drives such as only the HDDs or onlythe SSDs.

The processor 115 can execute software programs and calculations toaccess the storage device such as HDDs 150 and/or SSDs 155, receivedetection results/signals generated from the sensor module 120, controlthe UI device 110 to display data patterns for the operator based on thedetection results/signals, and receive inputs/commands of the operatorvia the UI device 110. The software programs can be stored or recordedin the HDDs 150 or in the SSDs 155 in advanced.

As mentioned above, the UI device 110 can display the data patterncorresponding to the detection signal on its display panel 1101 for theoperator which can view the data pattern on the display panel 1101 andaccordingly mark a region of a picture displayed on the display panel1101 to select a partial pattern so as to select a portion of thedetection signal by using the computer mouse and then the selectionsignal portion can be transmitted to the processor 115.

The sensor module 120 is arranged to periodically perform detection uponthe computer storage node 105 to repeatedly generate detection signals(i.e. results). For example, the sensor module 120 is used to sense atleast one operation parameter of the computer storage device 105 togenerate a first detection signal and a second detection signal whichfollows the first detection signal.

In practice, the sensor module 120 can be implemented by using puresoftware program algorithms or a combination of software programs andhardware circuits; this is not intended to be a limitation. For example,the sensor module 120 is used to periodically detect or sense at leastone of the CPU usage (i.e. a percentage of CPU capacity),network/traffic/packet flow usage, I/O pattern type, CPU temperature,fan speed, storage usage, IOPS (input/output operations per second) ofthe HDD/SSD, input/output latency, file system operation time, and soon, so as to generate a detection result/signal to the processor 115.That is, the at least one operation parameter comprises the CPU usage(i.e. a percentage of CPU capacity), network/traffic/packet flow usage,I/O pattern type, CPU temperature, fan speed, storage usage, IOPS(input/output operations per second) of the HDD/SSD, input/outputlatency, file system operation time, and so on.

For example, the software of sensor module 120 may be activated andexecuted by the processor 115 to sense the CPU usage every N seconds togenerate multiple percentage values of the processor 115 during multipleintervals having N seconds wherein N may be equal to five or ten (butnot limited), and a detection signal comprises multiple percentagevalues of the processor 115 every N seconds.

Similarly, the software of sensor module 120 may be activated andexecuted by the processor 115 to sense the network IC 125 to generatemultiple accumulated/average traffic flow amounts of the network IC 125during different intervals each having identical seconds, and adetection signal in this situation comprises the accumulated/averagetraffic flow amounts.

Similarly, the sensor module 120 can be used to sense the network IC 125to obtain the I/O pattern type periodically, and a detection signal maycomprise multiple I/O pattern types for different time intervals. Forinstance, the I/O pattern type may be random I/O, sequential I/O, orother different types. The operation of sensing storage usage, IOPS ofthe HDD/SSD, latency, and file system operation time can be achieved byusing the processor 115 to periodically activate and execute thesoftware of sensor module 120. Further, for sensing the CPU temperature,the sensor module 120 is configured to comprise a physical temperaturesensor circuit which is used to sense the temperature of one or moreCPUs included in the processor 115 so as to generate detectedtemperatures, and the processor 115 can activate and execute thesoftware of sensor module 120 to collect the detected temperatures toform a detection signal.

It should be noted that in practice the sensor module 120 is arranged toperiodically collect the real-time CPU usage value, calculate a value ofreal-time network/traffic/packet flow usage, collect a value/bit forindicating real-time I/O pattern type, and collect real-time fan speed,real-time storage usage value, real-time IOPS, real-time latency, andreal-time file system operation time. For example, the processor 115 isarranged to execute the software of sensor module 120 to collect thevalue(s) to obtain a detection signal. Different data values fordifferent time intervals form a detection signal, i.e. a raw detectionsignal/result. The detection signals generated by the sensor module 120are sequentially transmitted to the processor 115.

The processor 115 is used to receive the first detection signal tocontrol the display panel 1101 to display a data pattern of the firstdetection signal on the display panel 1101 according to a time scale,use a first portion of the first detection signal corresponding to apartial pattern of the data pattern to generate a reference signal whenthe operator uses the computer input device 1102 to mark a region on thedisplay panel 1101 to select the partial pattern, receive the seconddetection signal sent from the sensor module 120 after the referencesignal is generated, and compare characteristics of the reference signalwith characteristics of the second detection signal to perform abehavior analysis operation. The characteristics for example comprise atleast one of a signal amplitude value, a signal frequency, a frequencydistribution, and a peak amplitude value (but not limited). Othercharacteristics of detection signals can be applied into the operationof behavior analysis.

If the partial pattern is selected by the operator as an abnormalpattern, then the processor 115 is used to generate an abnormalreference signal by using the first portion of the first detectionsignal corresponding to the abnormal pattern and determine that anabnormal behavior occurs when the characteristics of the abnormalreference signal matches to characteristics of at least one portion ofthe second detection signal. If the partial pattern is selected by theoperator as a normal pattern, then the processor 115 is used to generatea normal reference signal by using the first portion of the firstdetection signal corresponding to the normal pattern and determine thatan abnormal behavior occurs when the characteristics of the normalreference signal do not match to characteristics of a portion of thesecond detection signal. The processor 115 is arranged to performabnormal behavior analysis and/or behavior prediction upon an incomingsensor result such as the second detection signal based on a previoussensor result (i.e. the first detection signal).

FIG. 3 is a diagram illustrating an example of a raw data patterndisplayed on the display panel 1101 of the UI device 110 based on a timescale such as hours (but not limited) according to one embodiment of theinvention. The time scale may be seconds, minutes, hours, days, weeks,and/or months, and the processor 115 can use or change different timescales to control the display panel of UI device 110 to displaydifferent data patterns of the same detection signal for the operator.The operator can directly view the displayed data pattern and then usethe computer mouse or computer keyboard to mark/select a region on thedisplay panel 1101 to select a partial pattern of the raw data patternas a reference pattern (a normal pattern or an abnormal pattern). It isnot needed for the operator to key in some fixed values as thresholds todefine a normal pattern or an abnormal pattern.

FIG. 4 is a diagram illustrating an example of a raw data patterndisplayed on the display panel 1101 of the UI device 110 based on a timescale such as hours (but not limited) according to another embodiment ofthe invention. As shown in the example of FIG. 4, an operator uses thecomputer mouse or computer keyboard to mark/select a region (shown bydotted lines) to select a partial displayed pattern within the region asa reference normal pattern.

FIG. 5 is a diagram illustrating an example of a raw data patterndisplayed on the display panel 1101 of the UI device 110 based on a timescale such as hours (but not limited) according to another embodiment ofthe invention. As shown in the example of FIG. 5, an operator uses thecomputer mouse or computer keyboard to mark/select a region (shown bydotted lines) to select a partial displayed pattern within the region asa reference abnormal pattern. That is, the operator selects a peakportion of the raw data pattern by using the region to mark the peakportion.

After the operator selects a partial pattern as a normal pattern or asan abnormal pattern, the selected result (i.e. the selected partialpattern) is transmitted to the processor 115. The processor 115 is usedto store the selected normal/abnormal pattern and generate a referencenormal/abnormal signal according to a portion of the first detectionsignal corresponding to the selected normal/abnormal pattern. Then theprocessor 115 is used to compare the characteristics of the referencenormal/abnormal signal with the characteristics of the second detectionsignal to perform the behavior analysis operation.

The selected partial pattern is a user-defined normal pattern or auser-defined abnormal pattern. For implementation of software blocks,the processor 115 may be used to activate and execute a predict engineto compare the characteristics of incoming detection signal with thereference signal corresponding to the user-defined normal/abnormalpattern to decide whether an abnormal behavior occurs. FIG. 6 is a blockdiagram showing multiple software blocks of programs executed by theprocessor 115 to real-time perform behavior analysis. For example, thepredict engine 605 activated and executed by the processor 115 is usedto collect and obtain the data signals sent from the sensor module 120.

In addition, a filter module 610 can be employed by the processor 115 tofilter out some extreme values in the detection signal(s) to generateprocessed detection signal(s) to the predict engine 605. Then, thepredict engine 605 is arranged to compare characteristics of a processeddetection signal with those of the reference signal corresponding to theuser-defined normal/abnormal pattern 615 to generate a predictresult/signal 620, store the processed detection signal into thedatabase 625, and to generate the decision result (whether thecharacteristics are matched or not) to the behavior analysis module 630which is used to determine whether an abnormal behavior occurs accordingto the decision result. For example, if characteristics of all portionsof the processed detection signal match to those of the normal referencesignal corresponding to the user-defined normal pattern, then thebehavior analysis module 630 will determine that no abnormal behaviorsoccur. If characteristics of a portion of processed detection signalmatch to those of the abnormal reference signal corresponding to theuser-defined abnormal pattern, then the behavior analysis module 630will determine that an abnormal behavior occurs.

The predict result 620 then is fed back to predict engine 605 via theuser defied rule block 635. The user defined rule block 635 executed bythe processor 115 is arranged to select a corresponding rule accordingto a request of the operator. For example, the operator may want toadjust the time scale displayed on the display panel 1101 of UI device110, and the user defined rule block 635 is arranged to adjust thedisplayed time scale based on the operator's request. After thedisplayed time scale is adjusted based on the user defined rule block635, the predict engine 605 is arranged to generate the predict result620 according to the time scale, the selected strategy, and theuser-defined normal/abnormal pattern. The adjusting of time scale ismerely used for illustration and is not intended to be a limitation. Inaddition, the selected strategy is determined by the operator and may bea less aggressive strategy or a more aggressive strategy.

Further, in other embodiments, the detection signal may be convertedinto the frequency domain by the processor 115 to generate a statisticdata pattern/signal having a frequency distribution and then isdisplayed on the display panel 1101 of UI device 110, so that theoperator may select a frequency portion of the statistic data pattern asa normal pattern or as an abnormal pattern. The modification also fallswithin the scope of the invention.

In addition, the operator can operate the UI device 110 to select adifferent time scale so that the same detection signal may be displayedwith different patterns at different time scales.

In practice, when the operator changes the time scale, the processor 115is used to generate the data pattern to be displayed on the displaypanel according to the raw detection signal. The time scales maycomprise seconds, minutes, hours, days, weeks, and/or months. Inpractice, when receiving the first detection signal, the processor 115for example is arranged to change the time scale to a different timescale, control the display panel 1101 of the user interface device 110to display a different data pattern of the first detection signal on thedisplay panel 1101 according to the different time scale, use a secondportion of the first detection signal corresponding to a partial patternof the different data pattern to generate another reference signal whenthe operator uses the user interface device 110 to mark another regionon the display panel to select the partial pattern of the different datapattern, receive the second detection signal sent from the sensor module120 after the another reference signal is generated, and comparecharacteristics of the another reference signal with characteristics ofthe second detection signal to perform the behavior analysis operation.

In some situations, even though the partial pattern of the data patterndisplayed at the time scale such as minutes is different from thepartial pattern of the another data pattern displayed at the differenttime scale such as hours, the first portion of the first detectionsignal may be equivalent to the second portion of the first detectionsignal.

Those skilled in the art will readily observe that numerousmodifications and alterations of the device and method may be made whileretaining the teachings of the invention. Accordingly, the abovedisclosure should be construed as limited only by the metes and boundsof the appended claims.

What is claimed is:
 1. A method utilized in one of computer storagenodes in a distributed shared storage system, comprising: providing auser interface device to be operated by an operator; sensing at leastone operation parameter of the computer storage node to generate a firstdetection signal; and providing and utilizing a processor to perform:controlling a display panel of the user interface device to display adata pattern of the first detection signal on the display panelaccording to a time scale selected/adjusted by the operator; using thedisplay panel displaying the data pattern of the first detection signalfor the operator based on the adjusted time scale to make the operatorselect the data pattern's partial pattern which is located within aregion displayed by the display panel, the data pattern's other portionsare not located within the region; in response to the partial patternselected by the operator, using a first portion of the first detectionsignal corresponding to only the partial pattern of the data pattern asa reference signal, the reference signal is generated as a normalreference signal in response to an event that the operator selects thepartial pattern as a normal pattern and the reference signal isgenerated as an abnormal reference signal in response to an event thatthe operator selects the partial pattern as an abnormal pattern; andcomparing characteristics of the reference signal with characteristicsof a processed detection signal to perform a behavior predictionoperation.
 2. The method of claim 1, wherein the partial pattern isselected by the operator as an abnormal pattern, and the step ofgenerating the reference signal comprises: generating an abnormalreference signal by using the first portion of the first detectionsignal corresponding to the abnormal pattern; and the comparing stepcomprises: determining that an abnormal behavior occurs when thecharacteristics of the abnormal reference signal matches tocharacteristics of at least one portion of the processed detectionsignal.
 3. The method of claim 1, wherein the partial pattern isselected by the operator as a normal pattern, and the step of generatingthe reference signal comprises: generating a normal reference signal byusing the first portion of the first detection signal corresponding tothe normal pattern; and the comparing step comprises: determining thatan abnormal behavior occurs when the characteristics of the normalreference signal do not match to characteristics of a portion of theprocessed detection signal.
 4. The method of claim 1, wherein the atleast one operation parameter comprises CPU usage, storage usage,network traffic/flow/packet usage, input/output (I/O) pattern type, CPUtemperature, fan speed, input/output operations per second (IOPS), I/Olatency, and file system operation time.
 5. The method of claim 1,wherein the characteristics of the reference signal comprises at leastone of a signal amplitude value, a signal frequency, a frequencydistribution, and a peak amplitude value.
 6. The method of claim 1,further comprising: changing the time scale to a different time scale;using the processor to control the display panel of the user interfacedevice to display a different data pattern of the first detection signalon the display panel according to the different time scale; using asecond portion of the first detection signal corresponding to a partialpattern of the different data pattern to generate another referencesignal when the operator uses the user interface device to mark anotherregion on the display panel to select the partial pattern of thedifferent data pattern; receiving the processed detection signal afterthe another reference signal is generated; and comparing characteristicsof the another reference signal with characteristics of the processeddetection signal to perform the behavior prediction operation.
 7. Themethod of claim 6, wherein the first portion of the first detectionsignal is equivalent to the second portion of the first detection signalwhile the partial pattern of the data pattern displayed at the timescale is different from the partial pattern of the another data patterndisplayed at the different time scale.
 8. A computer storage node in aplurality of computer storage nodes in a distributed shared storagesystem, comprising: a user interface device, comprising: a displaypanel, configured to display information for a user; and at least onecomputer input device operated by an operator; a sensor module,configured to sense at least one operation parameter of the computerstorage node to generate a first detection signal; and a processor,coupled to the user interface device and the sensor module, configuredto: control a display panel of the user interface device to display adata pattern of the first detection signal on the display panelaccording to a time scale selected/adjusted by the operator; use thedisplay panel displaying the data pattern of the first detection signalfor the operator based on the adjusted time scale to make the operatorselect the data pattern's partial pattern which is located within aregion displayed by the display panel, the data pattern's other portionsare not located within the region; in response to the partial patternselected by the operator, using a first portion of the first detectionsignal corresponding to only the partial pattern of the data pattern asa reference signal, the reference signal is generated as a normalreference signal in response to an event that the operator selects thepartial pattern as a normal pattern and the reference signal isgenerated as an abnormal reference signal in response to an event thatthe operator selects the partial pattern as an abnormal pattern; andcompare characteristics of the reference signal with characteristics ofa processed detection signal to perform a behavior prediction operation.9. The computer storage node of claim 8, wherein the partial pattern isselected by the operator as an abnormal pattern, and the processor isused to: generating an abnormal reference signal by using the firstportion of the first detection signal corresponding to the abnormalpattern; and determine that an abnormal behavior occurs when thecharacteristics of the abnormal reference signal matches tocharacteristics of at least one portion of the processed detectionsignal.
 10. The computer storage node of claim 8, wherein the partialpattern is selected by the operator as a normal pattern, and theprocessor is used to: generate a normal reference signal by using thefirst portion of the first detection signal corresponding to the normalpattern; and determine that an abnormal behavior occurs when thecharacteristics of the normal reference signal do not match tocharacteristics of a portion of the processed detection signal.
 11. Thecomputer storage node of claim 8, wherein the at least one operationparameter comprises CPU usage, storage usage, networktraffic/flow/packet usage, input/output (I/O) pattern type, CPUtemperature, fan speed, input/output operations per second (IOPS), I/Olatency, and file system operation time.
 12. The computer storage nodeof claim 8, wherein the characteristics of the reference signalcomprises at least one of a signal amplitude value, a signal frequency,a frequency distribution, and a peak amplitude value.
 13. The computerstorage node of claim 8, wherein the processor is used to: change thetime scale to a different time scale; control the display panel of theuser interface device to display a different data pattern of the firstdetection signal on the display panel according to the different timescale; use a second portion of the first detection signal correspondingto a partial pattern of the different data pattern to generate anotherreference signal when the operator uses the user interface device tomark another region on the display panel to select the partial patternof the different data pattern; receive the processed detection signalafter the another reference signal is generated; and comparecharacteristics of the another reference signal with characteristics ofthe processed detection signal to perform the behavior predictionoperation.
 14. The computer storage node of claim 13, wherein the firstportion of the first detection signal is equivalent to the secondportion of the first detection signal while the partial pattern of thedata pattern displayed at the time scale is different from the partialpattern of the another data pattern displayed at the different timescale.